Guide
Read a TLS scan report
A grade compresses many observations into one label. Read the evidence, target and coverage before deciding what to fix.
Check what was scanned
Begin with the hostname, port, address family, time and the name sent through Server Name Indication. One hostname can resolve to several addresses, and a load balancer can serve different certificates or configurations across backends. A scan from one network location observes only the path and endpoint it reached. An incomplete connection or timeout should remain marked incomplete, not converted to a passing finding.
Separate the layers
Protocol support reports which versions a server was willing to negotiate. Cipher and key-exchange findings describe offered cryptographic choices under those versions. A server that supports a strong TLS 1.3 handshake might still offer weaker options to older clients; inspect the full offered set and the negotiated examples. TLS 1.3 also separates key exchange and authentication from the cipher-suite name differently from earlier versions, so do not compare suite names as if their fields were identical.
The certificate section answers a different question: whether the presented name matches the target, the validity period covers the scan time, and a usable path leads to a trusted anchor under the scanner's trust store. An omitted intermediate can break path building even when the leaf certificate looks fine. Revocation status may be unknown if the scanner did not check it. A valid certificate does not establish that the application behind TLS handles secrets or sessions safely.
Use grades as navigation, not proof
SSL Labs describes a server rating based on certificate checks, protocol support, key exchange, ciphers and rule-based grade caps. testssl.sh aims to approximate that guide but documents possible differences. A grade is useful for finding a section to inspect; it is not a claim that every client, backend or application path is secure. For each serious finding, keep the tested handshake or certificate evidence, affected endpoint and scanner status. Retest after a change against the same target and, where possible, all known addresses and relevant client profiles.
The quick and full TLS tools planned for this site are not deployed yet. This guide describes how to read a future report or a report from a local scanner; it does not imply that this site has tested any host.